SolarWinds Security Incident

Key Points SolarWinds and its chief information security officer were charged with fraud for making allegedly misleading statements in SEC filings related to known cybersecurity risks. CISOs, particularly those with SEC certification duties, need to be mindful of their internal communications, as compared to SEC and other public disclosures; ensure adequate policies and procedures are in place; and promptly escalate any potential reporting concerns to enable informed decision-making by senior management. Boards should be mindful of the need to maintain rigorous and transparent disclosure practices, ensuring that known vulnerabilities and prior security incidents are accurately reflected in public disclosures to prevent potential enforcement exposure. Summary of Complaint On October 30, 2023, the SEC filed a litigated complaint against SolarWinds, a software development company, and Timothy Brown, its chief information security officer (CISO). The SEC alleges that from October 2018, when SolarWinds went public, to January 2021, SolarWinds and Brown made materially misleading statements and omissions about the companys cybersecurity practices and risks in public disclosures, which the SEC claims ultimately led to a drop in SolarWinds stock following the later disclosure of a large-scale cybersecurity attack known as SUNBURST. Specifically, the complaint alleges that SolarWinds and Brown inaccurately claimed on a website security statement that the company followed cybersecurity standards like the National Institute of Standards and Technology Cybersecurity Framework (NIST framework), used Secure Development Lifecycle (SDL) practices, enforced strong password policies and maintained adequate access controls. Further, the SEC alleges that SolarWindss periodic filings included generic and hypothetical cybersecurity risk statements that failed to address known risks. Finally, the SEC alleges that, at the time of drafting the Form 8-K filed on December 14, 2020,...

... (truncated for display)